Guide for audit and risk committees on financial reporting ...€¦ · management is responsible for completing a full assessment of whether the organisation is a going concern, considering

Reportby the Comptroller and Auditor General

Good Practice Guide

Guide for audit and risk committees on financial reporting and management during COVID-19

HC 524 SESSION 2019–2021 24 JUNE 2020

A picture of the National Audit Office logo

We are the UK’s independent public spending watchdog.We support Parliament in holding government to account and we help improve public services through our high-quality audits.

The National Audit Office (NAO) scrutinises public spending for Parliament and is independent of government and the civil service. We help Parliament hold government to account and we use our insights to help people who manage and govern public bodies improve public services. The Comptroller and Auditor General (C&AG), Gareth Davies, is an Officer of the House of Commons and leads the NAO. We audit the financial accounts of departments and other public bodies. We also examine and report on the value for money of how public money has been spent. In 2018, the NAO’s work led to a positive financial impact through reduced costs, improved service delivery, or other benefits to citizens, of £539 million.

Good Practice Guide

Guide for audit and risk committees on financial reporting and management during COVID-19

Report by the Comptroller and Auditor General

Ordered by the House of Commons to be printed on 23 June 2020

This guide has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Gareth Davies Comptroller and Auditor General National Audit Office

22 June 2020

HC 524 | £10.00

This guide aims to help audit and risk committee members discharge their responsibilities and to examine the impacts on their organisations of the COVID-19 outbreak. It is part of a programme of work undertaken by the NAO to support Parliament in its scrutiny of the UK government’s response to COVID-19.

© National Audit Office 2020

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact [email protected]. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

009156 06/20 NAO

Good practice guideWe publish good practice guides on important issues to make it easier for others to understand and apply the lessons from our work.

The National Audit Office study team consisted of: Charlotte Borg and Robert O’Donoghue, under the direction of Siân Jones.

This guide can be found on the National Audit Office website at www.nao.org.uk

For further information about the National Audit Office please contact:

National Audit Office Press Office 157–197 Buckingham Palace Road Victoria London SW1W 9SP

Tel: 020 7798 7400

Enquiries: www.nao.org.uk/contact-us

Website: www.nao.org.uk

Twitter: @NAOorguk

ContentsIntroduction 4

Part OneAnnual reports 6

Part TwoFinancial reporting 8

Part ThreeControl environment 15

Part FourRegularity of expenditure 17

Appendix OneKey questions to ask 21

Appendix TwoFurther resources 26

Appendix ThreeNational Audit Office’s Fraud and Error Framework 28

If you are reading this document with a screen reader you may wish to use the bookmarks option to navigate through the parts. If you require any of the graphics in another format, we can provide this on request. Please email us at www.nao.org.uk/contact-us

4 Introduction Guide for audit and risk committees on financial reporting and management during COVID-19

Introduction

Background

1 The scale and nature of the current COVID-19 outbreak and government’s response is unprecedented in recent history. The outbreak has impacted on all public sector bodies, either through delivering the government’s response, or in dealing with challenges for individual organisations.

2 This guide is part of a programme of work to be undertaken by the National Audit Office (NAO) to support Parliament in its scrutiny of the UK government’s response to COVID-19. Our aim is to report in a risk-based way on programmes and activities being undertaken by government departments and other organisations, and also to support organisations’ own internal scrutiny and challenge.

3 Audit and risk committees are integral to the scrutiny and challenge process. They advise boards and accounting officers on matters of financial accountability, assurance and governance, and can support organisations, providing expert challenge, helping organisations focus on what is important, and how best to manage risk.

4 Each organisation will have existing risk management processes in place, but risk appetite may have changed as a result of COVID-19, for the organisation to operate effectively and respond in a timely manner. This may result in a weakening of controls in some areas, increasing the likelihood of other risks occurring. Organisations will need to consider how long this change in risk appetite is sustainable for.

Guide for audit and risk committees on financial reporting and management during COVID-19 Introduction 5

This guide

5 This guide aims to help audit and risk committee members discharge their responsibilities in several different areas, and to examine the impacts on their organisations of the COVID-19 outbreak, including on:

• annual reports;

• financial reporting;

• the control environment; and

• regularity of expenditure.

6 In each section of the guide we have set out some questions to help audit and risk committee members to understand and challenge activities. Each section can be used on its own, although we would recommend that audit and risk committee members consider the whole guide, as the questions in other sections may be interrelated. Each individual section has the questions at the end, but for ease of use all the questions are included in Appendix One.

7 The guide may also be used as organisations and audit and risk committees consider reporting in the 2020-21 period when more specific and detailed reporting on the outbreak will be required.

8 While this guide is intended to be a comprehensive consideration of areas that organisations, and audit and risk committees, will need to consider, each organisation will need to take account of its own unique circumstances in considering the impact of COVID-19. The guide is not exhaustive, and we would expect each organisation to familiarise themselves with the underlying guidance where relevant.

6 Part One Guide for audit and risk committees on financial reporting and management during COVID-19

Part One

Annual reports

1.1 The annual report is a key mechanism for transparent disclosure of an organisation’s in-year performance and governance matters. Disclosures in the annual report will help to provide information about the impact of COVID-19 on the organisation to users of annual reports and accounts.

1.2 This part sets out HM Treasury’s requirements for annual reports and potential questions for audit and risk committees to ask in the context of COVID-19.1 While the significant impacts of the outbreak only emerged in the UK in mid-March, there are some impacts in 2019-20. Annual report disclosures are expected to consider the period up to when the document is published.

Performance report

1.3 The purpose of the performance section of the annual report is to provide information on the entity, its main objectives and strategies and the principal risks it faces. The report should discuss how the entity has performed in the year, including areas where performance has deteriorated or is below expectations, where money has been spent and the other key risks impacting on the organisation.

1.4 HM Treasury expects that the performance report will detail the impact of COVID-19 on the organisation in 2019-20. While reporting could be more streamlined than in prior years, it should still provide enough information to satisfy parliamentary accountability and provide appropriate transparency. Any planned streamlining should be agreed with the relevant select committee or department before approval of the annual report and accounts.

1 We have summarised HM Treasury’s requirements for annual reports in this part. The full requirements can be found in the Government Financial Reporting Manual here: www.gov.uk/government/publications/government-financial-reporting-manual-2019-20. Specific COVID-19-related updates to this manual can be found here: www.gov.uk/government/publications/financial-reporting-manual-addendum-2019-20

Box A: Annual reports – questions audit and risk committees could ask

Guide for audit and risk committees on financial reporting and management during COVID-19 Part One 7

Accountability report

1.5 The purpose of the accountability section of the annual report is to meet key accountability requirements of Parliament. In the context of COVID-19, the corporate governance report element of the accountability report provides an important mechanism for organisations to outline how COVID-19 has affected governance arrangements, the control environment, changes to their risks and risk appetite, as well as any relevant considerations in relation to the regularity of expenditure.

Has COVID-19 caused new risks to achieving the organisation’s stated objectives?

• Does the performance report reflect the impact of COVID-19 on the organisation’s performance against objectives in the year?

• Does it clearly consider whether COVID-19 influenced the organisation’s ability to meet objectives?

• Does it consider the organisation’s performance in general, including where this deteriorated or was below expectations?

Does the corporate governance report consider whether expenditure in response to COVID-19 was in line with parliamentary authority (regular) and in accordance with the principles of Managing Public Money?2

• Where this was not the case, has this been clearly disclosed?

Does the corporate governance report detail how the control environment has changed due to COVID-19 and the risks associated with these changes?

• How does the report discuss new risks in relation to COVID-19 and the associated responses to these?

• Does the report discuss how the organisation’s risk appetite has changed?

• Where relevant, has any streamlining to the annual report due to COVID-19 been agreed with the relevant select committee or parent department?

Box A: Annual reports – questions audit and risk committees could ask

2 HM Treasury, Managing Public Money is available at: www.gov.uk/government/publications/managing-public-money

8 Part Two Guide for audit and risk committees on financial reporting and management during COVID-19

Part Two

Financial reporting

2.1 The effects of the COVID-19 outbreak and response could appear in different areas of the financial statements. This part considers key questions for audit and risk committees to consider, including:

• valuations, including property, pension scheme and inventory valuations;

• completeness of liabilities;

• going concern; and

• events after the reporting period.

Valuations

2.2 The economic uncertainty caused by COVID-19 has made valuations of assets and liabilities more challenging for 2019-20. We expect the biggest issues for management to be accessing reliable data sources to base valuations on, as well as significantly increased estimation uncertainty. Therefore, management should consider the following areas in preparing valuations for financial statements:

• Whether usual sources of information for valuations remain appropriate in the context of COVID-19 uncertainties, and if not, what alternative sources of information are available.

• Whether assumptions used in valuation models/estimates require updating because of COVID-19. This should include considerations that underpin credit loss calculations and impairment reviews where COVID-19 has changed the circumstances for creditors and markets.

• If there are additional sources of information that should be used for valuation judgements – such as updated customer information to determine expected credit losses or impairments.

• Whether there are practical impacts for some organisations where lockdown measures limit the ability for valuers to complete work on physical assets, including stock-takes as noted in the inventory valuations section below.

• If there will be more appropriate information that gives an indication of the situation at the year-end available before the finalisation of the financial statements.

Guide for audit and risk committees on financial reporting and management during COVID-19 Part Two 9

2.3 The financial statement disclosures should also be transparent in setting out all sensitive and material assumptions made in determining valuations.

What information has been used in determining the value of assets and liabilities?

• In the absence of timely information, how has management estimated valuations? Is this reasonable? How have changes in valuations for reasons due to COVID-19 been considered? Is there any other information that should be considered?

How have experts been used to support management in valuations?

• Where experts’ work was completed before the reporting date, how has management gained comfort that the valuation remains appropriate?

• Have the experts provided any caveats on their advice? If so, how have these been considered?

What are the key assumptions used to determine valuations and how has the relative probability of various outcome scenarios been assessed?

• Have the key assumptions been disclosed clearly?

Box B: Valuations – questions audit and risk committees could ask

Property valuations

2.4 The impact of COVID-19 on the economy and the impact of government restrictions has led to a significant slowing of the property market. As of April 2020, property sales in the UK were 46% lower than in March.3 This makes it more difficult for management, and its experts, to value significant property portfolios. In addition to the general valuation considerations set out above, we expect there could be specific challenges in the following areas of property valuation:

• Where management uses an expert to value property, the expert may include material uncertainty clauses in valuation reports, given the uncertain environment, which management will need to consider.

• Organisations not due to revalue property in 2019-20 may be using an indexation method to uplift prior-year valuations. Due to the lack of reliable and appropriate market data, organisations may find it difficult to identify appropriate indices to use.

• There are practical challenges due to the outbreak in relation to the physical verification of assets, impacting valuation judgements.

3 HM Revenue & Customs, UK Property Transactions Statistics, April 2020 update, available at: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/886277/MPT_Com_May_20__cir_.pdf

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/886277/MPT_Com_May_20__cir_.pdf

https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/886277/MPT_Com_May_20__cir_.pdf

Box C: Property valuations – questions audit and risk committees could ask


What data have management used for property valuations?

• Is this reasonable? Are there other data that could be used?

• Do these data consider how the market changed in late March 2020?

How have experts been used to support management in valuing property?


• If experts were not used for property valuations, should they have been given the current uncertainty?

Have the valuers been able to complete their work?

• If they have managed to complete their work, has a material uncertainty paragraph been included in their report?

• How has this clause been considered by management?

Where a full revaluation is not required in-year how has management valued property in the current market?

• Has management considered whether the indices used remain appropriate?

Have assets been physically verified?

• If not, how have impairment reviews been carried out? Are there any other impacts of not physically verifying property?

Is the disclosure of estimation uncertainty clear and understandable for users?

• Have all relevant sources of estimation uncertainty been disclosed?

Box C: Property valuations – questions audit and risk committees could ask

Pension scheme valuations

2.5 If an organisation participates in a defined benefit pension scheme, it may be required to recognise the deficit or surplus of that scheme as at year-end. The significant uncertainty associated with the COVID-19 outbreak will affect the measurement of pension scheme assets or liabilities in the following ways, in addition to the general valuation difficulties above:

• There may be increased complexity in valuing scheme assets, particularly where assets do not have an active market or where the valuation is affected by the volatility in the financial markets.

• Actuarial assumptions used to project the defined benefit obligation may require updating due to the outbreak, including financial assumptions such as discount rates and salary growth. As for general valuations, we would expect any changes in assumptions would be disclosed, along with any sensitivity analysis of these assumptions.

Box D: Pension schemes valuations – questions audit and risk committees could ask

Box E: Inventory valuations – questions audit and risk committees could ask


Has management held discussions with pension plan actuaries regarding changes to their assumptions due to COVID-19?

• What adjustments have been made to assumptions?

• Do the actuarial assumptions represent the information available at the reporting date?

What is the availability of information to be used in determining valuation?

• Where valuation information which does not date from the year-end has been used, how has management ensured this is accurate as at the reporting date?

Have pension plan actuaries provided any caveats in their reporting?

• If so, how has management taken account of these?

Box D: Pension schemes valuations – questions audit and risk committees could ask

Inventory valuations

2.6 In addition to the general valuation difficulties set out above, we anticipate specific inventory challenges in relation to the outbreak, including:

• organisations may encounter difficulties estimating the value of inventories held due to the volatile market conditions or a lack of a market in which to sell inventory due to lockdown restrictions;

• organisations may encounter greater obsolescence of perishable stock due to lockdown restrictions; and

• practical difficulties in completing physical inventory counts due to lockdown restrictions.

How has management gained comfort over the quantity and condition of the stock held at the reporting date?

• If stock counts have not been possible, what alternative procedures have management completed?

How has COVID-19 impacted inventory usage?

• When do you expect this to go back to normal?

• How has this impacted valuation forecasts?

How has management valued inventory held in the context of COVID-19?

• Is this reasonable? What other methods could have been considered?

Has management had to use new suppliers/hold inventory of new goods?

• How has management assured itself that the suppliers can supply or have supplied the goods at the quality or quantity required?

Box E: Inventory valuations – questions audit and risk committees could ask

BBox F: Completeness of liabilities – questions audit and risk committees could ask


Completeness of liabilities

2.7 The impact of COVID-19 may impact on the liabilities of an organisation. For example, new liabilities could emerge due to legal cases, contractual obligations, commitments or changes in assumptions and policies. The impact of COVID-19 could also lead to onerous contracts, as plans for contracts held could have changed, costs may have increased, or an organisation may be unable to fulfil contracts previously signed.

2.8 Management should consider the following areas in assessing the completeness of liabilities for financial statements:

• Consideration of all major contracts to identify potential onerous contracts.

• Re-assessment of the likelihood of open legal cases at the reporting date in consideration of the COVID-19 context.

• Use of the best available information to value new liabilities identified.

• Disclosure of assumptions made about material estimation uncertainty in relation to liabilities.

Are liabilities complete based on your knowledge of the business and the impact of COVID-19?

• Has management completed a robust review to identify onerous contracts?

• Are there any other areas of COVID-19 impacts that are not yet considered?

Is management using the best available and most up-to-date information to value?

• Where information is not available at the reporting date, has management completed adequate procedures to assess the impact of COVID-19?

Where there is estimation uncertainty is it disclosed transparently in the financial statements?

• Does this include sensitivity analysis?

Box F: Completeness of liabilities – questions audit and risk committees could ask

Going concern

2.9 An entity is a going concern unless management either intends to cease the activities of the organisation or has no realistic alternative but to do so. For some organisations, the impact of COVID-19 may leave management with no realistic alternative but to cease its activities. When preparing the financial statements, management is responsible for completing a full assessment of whether the organisation is a going concern, considering the impacts of COVID-19 and other events on the long-term viability of the organisation.

Box G: Going concern – questions audit and risk committees could ask


2.10 There may be material uncertainty related to going concern, caused by COVID-19 casting significant doubt on the organisation’s ability to continue to operate. Where this is the case, the financial statements must clearly state that there is material uncertainty related to going concern, and therefore it may be unable to realise its assets and discharge its liabilities in the normal course of business. The principal events or conditions casting doubt should be clearly disclosed in the financial statements.

2.11 For central government organisations that follow the Government Financial Reporting Manual, it is rare that activities completely cease, and it is more likely that the activities of an organisation that may be closing are transferred to an organisation that is continuing. In this case, going concern is presumed by virtue of the functions transferring, and therefore financial statements are prepared on this basis, but we would still expect management to document its consideration of the impact of COVID-19 on its future business plans.

2.12 Management should consider the following areas in making its going concern assessment:

• All information available about the future, including impacts of COVID-19 on the organisation’s future performance and agreement of future funding. This should be updated and considered until the financial statements are published.

• A view of at least, but not limited to, 12 months from the date when the financial statements are published.

• Specific considerations for the organisation and its specific risks.

Is management’s strategy or business plan from a period pre-COVID-19?

• Has this been updated? If not, is it clear why a plan from before the outbreak remains appropriate?

Is management’s forward plan robust in the context of COVID-19?

• Do forecasts represent the latest information available? Has management completed scenario-testing on its forecasts?

• Is the forward plan in line with your understanding?

Is management’s going concern consideration complete?

• Has management considered different eventualities and the likelihood of each?

Is there substantial doubt over the entity’s ability to continue as a going concern?

• Do the disclosures in the financial statements reflect the impact of COVID-19 transparently?

Box G: Going concern – questions audit and risk committees could ask

Box H: Events after the reporting period – questions audit and risk committees could ask


Events after the reporting period

2.13 The impacts of the COVID-19 pandemic emerged in March 2020 around the year-end for many government organisations, increasing the likelihood of events after the reporting period that may require disclosure in the financial statements. This may include events such as new liabilities for the organisation as a result of new COVID-19-related activities, changes in key contractual arrangements impacting the organisation, or impacts on the recoverability of the organisation’s asset values.

2.14 Management are required to consider two types of potential events after the reporting period:

• those that provide evidence of conditions that existed at the date of the financial statements (adjusting events); and

• those that provide evidence of conditions that arose after the date of the financial statements (non-adjusting events).

2.15 Adjusting events would lead to the financial statements of an organisation being updated for the impact of the change, whereas non-adjusting events are only disclosed if material to the organisation, in the events after the reporting date note.

Have management considered all relevant events after the reporting date that could impact on the organisation?

• Are these events correctly assessed as adjusting or non-adjusting events?

• Do the financial statements make clear how COVID-19 has impacted the organisation in general after the reporting period date?

Do the financial statements appropriately recognise the events identified?

• Are the financial statements appropriately adjusted for relevant adjusting events?

• Have non-adjusting events been clearly and transparently disclosed?

• Is the value of non-adjusting events and potential impact for the organisation clear?

Box H: Events after the reporting period – questions audit and risk committees could ask

Guide for audit and risk committees on financial reporting and management during COVID-19 Part Three 15

Part Three

Control environment

3.1 The internal controls in place at many organisations may have stopped, required modification or been overridden by new controls introduced to adapt to the impact of the COVID-19 outbreak. Changes may have been made at pace to respond to a dynamic environment, which may impact effectiveness.

3.2 This part outlines some areas where controls may have changed as well as potential questions for audit and risk committees to ask in the context of COVID-19.

3.3 There may be changes in controls over preparing the financial statements in the following areas:

• Remote working may have impacted the ability for controls to operate as designed. Due to the quick transition, controls may have been changed at pace or not be operating as intended, increasing the risk of fraud and error.

• Operational imperative to deliver more quickly or due to changes in staff availability may mean standard procedures needed to be overridden.

• New activities not previously undertaken by the organisation may mean new processes were introduced at speed and may not be as robust.

• Senior management oversight may have been reduced due to urgent operational priorities.

• IT security systems may not have been designed for large-scale remote working and controls may have been reduced by the changed ways of working.

Box I: Control environment – questions audit and risk committees could ask

16 Part Three Guide for audit and risk committees on financial reporting and management during COVID-19

3.4 Where internal controls have been implemented or revised, management should consider whether it is sustainable in the longer term for the controls to operate in this way. For example, an increased burden on specific members of the organisation may be appropriate in the short term but, as the outbreak continues, there is a risk that the organisation becomes overly reliant on a small group of individuals. Management should consider how it can reinstate or strengthen the controls that are in place in order to operate in the current conditions for a sustained period. In the longer term, management should also consider what the desired control environment will look like and how to achieve it, when the outbreak has passed.

3.5 We would expect organisations to consider their risk assessments when making changes to their internal controls, enhancing and prioritising the critical controls needed to reduce the risk of fraud or error.

Were any changes needed to the design and implementation of internal controls to respond to COVID-19?

• What has been the impact of these changes? How long are these changes expected to last? Are the changes sustainable? How significant are these changes?

• Has internal audit assessed the design, implementation and operational effectiveness of revised internal controls? Can the negative impact of any changes be reversed?

Where changes were made to controls, did the organisation understand where there was increased risk because of this?

• Were other controls strengthened to compensate for this?

Has remote working affected the operational effectiveness of internal controls?

• Are any controls only able to be implemented in person, such as those over physical assets?

• Have changes in personnel performing the controls impacted effectiveness?

How have IT services performed during the outbreak?

• How has this impacted the effectiveness of controls?

• How have cyber security controls been considered?

Where service organisations are used, have there been any changes to the design and implementation of their controls?

• Where relevant, what has been the impact of this?

Box I: Control environment – questions audit and risk committees could ask

Guide for audit and risk committees on financial reporting and management during COVID-19 Part Four 17

Part Four

Regularity of expenditure

4.1 In response to COVID-19, organisations have been required to increase spending and, in some circumstances, incur expenditure on activities outside those permitted by original authorising legislation or other applicable delegated authority.

4.2 This part outlines the relevant regularity considerations for organisations, along with potential questions for audit and risk committees to ask in the context of COVID-19.

4.3 During the current circumstances, organisations and their accounting officers should still ensure that all expenditure adheres to the principles in Managing Public Money:4

• Regularity: if a proposal is outside an organisation’s framework of authorities, it is deemed irregular. The framework of authorities can be the legal powers, parliamentary authority, HM Treasury delegations or voted spend. If a department exceeds its spending limits authorised by Parliament, this is irregular and results in an excess vote and qualified regularity audit opinion.

• Propriety: if a proposal does not meet “standards of public conduct”, such as appropriate governance or parliamentary expectations.

• Value for money: if an alternative proposal, or doing nothing, would deliver better value (cheaper, higher quality or more effective use of funding).

• Feasibility: where there is a significant doubt about whether the proposal can be implemented accurately, sustainably or to the intended timetable.


18 Part Four Guide for audit and risk committees on financial reporting and management during COVID-19

4.4 Accounting officers should bring to the attention of the relevant minister any conflict between their instructions and the principles in Managing Public Money. If the minister decides to continue with this course of action even though the accounting officer has advised the instructions conflict with Managing Public Money, it would be expected that a ministerial direction would be provided. During the outbreak we have seen an increased use of ministerial directions. Where ministerial directions are required, management should bring the matter to the attention of the audit and risk committee and it should be disclosed in the corporate governance report.

Procurement Policy Note 02/2020

4.5 In response to the COVID-19 outbreak, the Cabinet Office has issued Procurement Policy Note (PPN) 02/2020 which sets out its expected approach for supplier payments during the outbreak.5 This PPN aims to ensure the continuity of service during the outbreak and ensure suppliers can resume normal contract delivery after the outbreak is over. The PPN is clear that the usual Managing Public Money principles of spend being regular, proper and value for money still apply.

4.6 The PPN instructs contracting authorities to pay all suppliers as quickly as possible to maintain cash flow and protect jobs. It advises that contracting authorities should take action to continue to pay suppliers at risk due to COVID-19 to ensure continuity and retention of the supply going forward. Where necessary, advanced payments to suppliers are permitted under the PPN.

4.7 Where the provisions of this PPN are being used by management, we would expect them to be clear that this was required to ensure continuity of service during the outbreak (or after the outbreak) and for all appropriate checks to be carried out and documented on the relevant suppliers before payments are made. The PPN requires suppliers to act on an open book basis, so we would expect management to have received relevant supporting data for payments made.

5 Procurement Policy Note 02/2020 is available at: www.gov.uk/government/publications/procurement-policy-note-0220-supplier-relief-due-to-covid-19

Box J: Regularity of expenditure – questions audit and risk committees could ask

Guide for audit and risk committees on financial reporting and management during COVID-19 Part Four 19

Have there been any significant changes to the organisation’s activities during the outbreak?

• If so, have the changes required new legislation or changes to delegated authorities?

Has the accounting officer assessed the reasonableness of increased expenditure or new activities in the context of Managing Public Money?

• Have ministerial directions been required? Have these been provided?

• Are these disclosed transparently in the corporate governance report?

Is there any new expenditure that could be deemed novel and contentious?

• How has this been treated?

Has management breached any control totals?

• Have there been any other regularity breaches or contentious issues?

Have the provisions in Procurement Policy Note 02/2020 been used by management?

• Has management carried out and documented appropriate due diligence checks on relevant suppliers?

• Have all other Managing Public Money provisions applied to payments made under the Procurement Policy Note?

• Has management received open book information from impacted suppliers?

Box J: Regularity of expenditure – questions audit and risk committees could ask

Fraud and error

4.8 A specific area of regularity that is impacted by COVID-19 is the potential for fraud and error in expenditure, which is heightened due to the pace of the COVID-19 response. This risk could manifest in several ways, including:

• procurement risks: new supply chains created at pace not allowing for complete risk assessments or single tender actions with no other options;

• contractor risks: new contractors being used at pace not allowing for appropriate due diligence;

• payments/grants/loans risks: new or expanded support schemes in place to support employers, employees and businesses during the outbreak that may not have appropriate controls in place; and

• cyber security risks: enhanced risk of cyber-attack, leading to fraud or error.

4.9 Instances where controls do not operate as intended due to the outbreak, or where organisations are required to spend at pace may also increase the likelihood of fraud and error.

Box K: Fraud and error – questions audit and risk committees could ask

20 Part Four Guide for audit and risk committees on financial reporting and management during COVID-19

National Audit Office’s Fraud and Error Framework

4.10 The Fraud and Error Framework (Appendix Three) is used to assess the effectiveness of an organisation’s response to fraud and error risk. The framework can provide prompts to support departments and larger organisations in regular reporting to the Cabinet Office on fraud risks and incidents. In responding to the outbreak, audit and risk committees may find the framework helpful in considering an organisation’s risk and exposures to fraud or error that arise from changes to business as usual, or when introducing new activities.

What exposure to fraud and error does the organisation have in its responses to COVID-19?

• Have controls been turned off or reduced?

• Are there new expenditure or procurement streams, or delivery methods that introduce new risks?

How is the organisation managing fraud and error risks?

• Are they logged, with a monetary estimate of the potential fraud and error exposure?

• Have options to reduce fraud and error been evaluated? Has management assessed the organisation’s risk appetite for losses through fraud and error? Are there any changes to this?

What processes are in place to measure fraud and error and evaluate the effectiveness of activities to prevent or detect this?

• How is management using this information to update risk assessments or inform controls?

• Does management have real-time indicators to support informed decisions on risks?

Box K: Fraud and error – questions audit and risk committees could ask

Box A: Annual reports

<Multiple intersecting links>

Guide for audit and risk committees on financial reporting and management during COVID-19 Appendix One 21

Appendix One

Key questions to ask

6


Has COVID-19 caused new risks to achieving the organisation’s stated objectives?

• Does the performance report reflect the impact of COVID-19 on the organisation’s performance against objectives in the year?

• Does it clearly consider whether COVID-19 influenced the organisation’s ability to meet objectives?

• Does it consider the organisation’s performance in general, including where this deteriorated or was below expectations?

Does the corporate governance report consider whether expenditure in response to COVID-19 was in line with parliamentary authority (regular) and in accordance with the principles of Managing Public Money?6

• Where this was not the case, has this been clearly disclosed?

Does the corporate governance report detail how the control environment has changed due to COVID-19 and the risks associated with these changes?

• How does the report discuss new risks in relation to COVID-19 and the associated responses to these?

• Does the report discuss how the organisation’s risk appetite has changed?

• Where relevant, has any streamlining to the annual report due to COVID-19 been agreed with the relevant select committee or parent department?

Box A: Annual reports

What information has been used in determining the value of assets and liabilities?

• In the absence of timely information, how has management estimated valuations? Is this reasonable? How have changes in valuations for reasons due to COVID-19 been considered? Is there any other information that should be considered?

How have experts been used to support management in valuations?


• Have the experts provided any caveats on their advice? If so, how have these been considered?

What are the key assumptions used to determine valuations and how has the relative probability of various outcome scenarios been assessed?

• Have the key assumptions been disclosed clearly?

Box B: Valuations

Box C: Property valuations

Box D: Pension schemes valuations

22 Appendix One Guide for audit and risk committees on financial reporting and management during COVID-19

What data have management used for property valuations?

• Is this reasonable? Are there other data that could be used?

• Do these data consider how the market changed in late March 2020?

How have experts been used to support management in valuing property?


• If experts were not used for property valuations, should they have been given the current uncertainty?

Have the valuers been able to complete their work?

• If they have managed to complete their work, has a material uncertainty paragraph been included in their report?

• How has this clause been considered by management?

Where a full revaluation is not required in-year how has management valued property in the current market?

• Has management considered whether the indices used remain appropriate?

Have assets been physically verified?

• If not, how have impairment reviews been carried out? Are there any other impacts of not physically verifying property?

Is the disclosure of estimation uncertainty clear and understandable for users?

• Have all relevant sources of estimation uncertainty been disclosed?

Box C: Property valuations

Has management held discussions with pension plan actuaries regarding changes to their assumptions due to COVID-19?

• What adjustments have been made to assumptions?

• Do the actuarial assumptions represent the information available at the reporting date?

What is the availability of information to be used in determining valuation?

• Where valuation information which does not date from the year-end has been used, how has management ensured this is accurate as at the reporting date?

Have pension plan actuaries provided any caveats in their reporting?

• If so, how has management taken account of these?

Box D: Pension schemes valuations

<Multiple intersecting links>

Box G: Going concern

Box E: Inventory valuations


How has management gained comfort over the quantity and condition of the stock held at the reporting date?

• If stock counts have not been possible, what alternative procedures have management completed?

How has COVID-19 impacted inventory usage?

• When do you expect this to go back to normal?

• How has this impacted valuation forecasts?

How has management valued inventory held in the context of COVID-19?

• Is this reasonable? What other methods could have been considered?

Has management had to use new suppliers/hold inventory of new goods?

• How has management assured itself that the suppliers can supply or have supplied the goods at the quality or quantity required?

Box E: Inventory valuations

Are liabilities complete based on your knowledge of the business and the impact of COVID-19?

• Has management completed a robust review to identify onerous contracts?

• Are there any other areas of COVID-19 impacts that are not yet considered?

Is management using the best available and most up-to-date information to value?

• Where information is not available at the reporting date, has management completed adequate procedures to assess the impact of COVID-19?

Where there is estimation uncertainty is it disclosed transparently in the financial statements?

• Does this include sensitivity analysis?

Box F: Completeness of liabilities

Is management’s strategy or business plan from a period pre-COVID-19?

• Has this been updated? If not, is it clear why a plan from before the outbreak remains appropriate?

Is management’s forward plan robust in the context of COVID-19?

• Do forecasts represent the latest information available? Has management completed scenario-testing on its forecasts?

• Is the forward plan in line with your understanding?

Is management’s going concern consideration complete?

• Has management considered different eventualities and the likelihood of each?

Is there substantial doubt over the entity’s ability to continue as a going concern?

• Do the disclosures in the financial statements reflect the impact of COVID-19 transparently?

Box G: Going concern

Box H: Events after the reporting period

Box I: Control environment

24 Appendix One Guide for audit and risk committees on financial reporting and management during COVID-19

Have management considered all relevant events after the reporting date that could impact on the organisation?

• Are these events correctly assessed as adjusting or non-adjusting events?

• Do the financial statements make clear how COVID-19 has impacted the organisation in general after the reporting period date?

Do the financial statements appropriately recognise the events identified?

• Are the financial statements appropriately adjusted for relevant adjusting events?

• Have non-adjusting events been clearly and transparently disclosed?

• Is the value of non-adjusting events and potential impact for the organisation clear?

Box H: Events after the reporting period

Were any changes needed to the design and implementation of internal controls to respond to COVID-19?

• What has been the impact of these changes? How long are these changes expected to last? Are the changes sustainable? How significant are these changes?

• Has internal audit assessed the design, implementation and operational effectiveness of revised internal controls? Can the negative impact of any changes be reversed?

Where changes were made to controls, did the organisation understand where there was increased risk because of this?

• Were other controls strengthened to compensate for this?

Has remote working affected the operational effectiveness of internal controls?

• Are any controls only able to be implemented in person, such as those over physical assets?

• Have changes in personnel performing the controls impacted effectiveness?

How have IT services performed during the outbreak?

• How has this impacted the effectiveness of controls?

• How have cyber security controls been considered?

Where service organisations are used, have there been any changes to the design and implementation of their controls?

• Where relevant, what has been the impact of this?

Box I: Control environment

Box J: Regularity of expenditure

Box K: Fraud and error


Have there been any significant changes to the organisation’s activities during the outbreak?

• If so, have the changes required new legislation or changes to delegated authorities?

Has the accounting officer assessed the reasonableness of increased expenditure or new activities in the context of Managing Public Money?

• Have ministerial directions been required? Have these been provided?

• Are these disclosed transparently in the corporate governance report?

Is there any new expenditure that could be deemed novel and contentious?

• How has this been treated?

Has management breached any control totals?

• Have there been any other regularity breaches or contentious issues?

Have the provisions in Procurement Policy Note 02/2020 been used by management?

• Has management carried out and documented appropriate due diligence checks on relevant suppliers?

• Have all other Managing Public Money provisions applied to payments made under the Procurement Policy Note?

• Has management received open book information from impacted suppliers?

Box J: Regularity of expenditure

What exposure to fraud and error does the organisation have in its responses to COVID-19?

• Have controls been turned off or reduced?

• Are there new expenditure or procurement streams, or delivery methods that introduce new risks?

How is the organisation managing fraud and error risks?

• Are they logged, with a monetary estimate of the potential fraud and error exposure?

• Have options to reduce fraud and error been evaluated? Has management assessed the organisation’s risk appetite for losses through fraud and error? Are there any changes to this?

What processes are in place to measure fraud and error and evaluate the effectiveness of activities to prevent or detect this?

• How is management using this information to update risk assessments or inform controls?

• Does management have real-time indicators to support informed decisions on risks?

Box K: Fraud and error

26 Appendix Two Guide for audit and risk committees on financial reporting and management during COVID-19

Appendix Two

Further resources

Below is a selection of guidance and insights that may be useful.

1 HM Treasury, Managing Public Money, March 2018, available at: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/742188/Managing_Public_Money__MPM__2018.pdf

2 HM Treasury, Audit and risk committee handbook, March 2016, available at: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/512760/PU1934_Audit_committee_handbook.pdf

3 The Institute of Chartered Accountants in England and Wales, Coronavirus: (COVID-19): considering going concern, 2020, available at: www.icaew.com/technical/audit-and-assurance/coronavirus-considering-going-concern

4 The Pensions Regulator, COVID-19 guidance for employers, April 2020, available at: www.thepensionsregulator.gov.uk/en/media-hub/press-releases/2020-press-releases/new-covid-19-pension-guidance-published-for-employers

5 The Royal Institution of Chartered Surveyors, Valuation practice alert COVID-19, 2020, available at: www.rics.org/uk/upholding-professional-standards/sector-standards/valuation/valuation-coronavirus/

6 The Institute of Chartered Accountants in England and Wales, Coronavirus and financial reporting, 2020, available at: www.icaew.com/coronavirus/financial-reporting

7 Financial Reporting Council, FRC COVID-19 Response, 2020, available at: www.frc.org.uk/covid-19-guidance-and-advice

8 International Auditing and Assurance Standards Board, Subsequent Events in the Current Evolving Environment, 2020, available at: www.iaasb.org/publications/subsequent-events-current-evolving-environment-audit-considerations-impact-covid-19

Guide for audit and risk committees on financial reporting and management during COVID-19 Appendix Two 27

9 HM Treasury, Addendum to Government Financial Reporting Manual 2019-20: minimum reporting requirements, 2020, available at: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/884468/2019-20_Government_Financial_Reporting_Manual_-_addendum.pdf

10 HM Government, The Orange Book: Management of Risk – Principles and Concepts, 2020, available at: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/866117/6.6266_HMT_Orange_Book_Update_v6_WEB.PDF

This figure shows The National Audit Office’s Fraud and Error Framework

28 Appendix Three Guide for audit and risk committees on financial reporting and management during COVID-19

Appendix Three

National Audit Office’s Fraud and Error Framework

Source: National Audit Offi ce

Implement

Evaluate

Measure

Strategy andgovernance

Design

Sustainable reduction in

fraud and error

The Framework assesses an entity’s approach to managing fraud and error risks. Based on good practice seen in government entities and the private sector, the overall principle is to understand and target risks and causes in a way that achieves greatest impact, and over time iterate the approach based on information on the efficacy of interventions and residual or new risks, to best direct interventions and drive a sustainable reduction in fraud and error.

Evaluate:

Does the organisation understand which are the effective key indicators of fraud and error?

Does the organisation understand what the results of its measurement work tell it about its exposure to fraud and error and the efficacy of its controls?

How will the organisation use measurement and detected error data to revise and refresh and iterate its approach to fraud and error?

Measure:

What measurement basis is used to assess fraud and error?

What balance is appropriate between continuous, ‘business as usual’ and periodic measurement and evaluation of fraud and error?

Strategy and governance:

What is the organisation’s fraud and error risk appetite?

What are the key priorities for fraud and error interventions?

What are the appropriate governance arrangements for fraud and error in the organisation?

How do processes and controls align to policy?

Implement:

How can accuracy in processing be achieved? How will the tension between a manageable workload of controls versus ambition of strategy be managed?

How will the organisation know whether controls are implemented as designed?

Are resourcing decisions informed by an impact on controls and fraud and error?

Design:

Are fraud and error risks and entry points understood?

What data sources are available for verification controls?

Is the expected cost and impact of each control understood?

What is the desired balance between ‘prevent and detect’ activities?

This report has been printed on Pro Digital Silk and contains material sourced from responsibly managed and sustainable forests certified in accordance with the FSC (Forest Stewardship Council).

The wood pulp is totally recyclable and acid-free. Our printers also have full ISO 14001 environmental accreditation, which ensures that they have effective procedures in place to manage waste and practices that may affect the environment.

£10.00

9 781786 043221

ISBN 978-1-78604-322-1

Design and Production by NAO External Relations DP Ref: 009156-001

You have reached the end of this document

Documents

Guide for audit and risk committees on financial reporting ...€¦ · management is responsible for completing a full assessment of whether the organisation is a going concern, considering